CVE-2022-22980

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

CVE-2022-22980

CVE-2022-22980 is a SpEL injection flaw in Spring Data MongoDB where @Query/@Aggregation queries containing parameter placeholders can be exploited if input isn’t sanitized. Public advisories (VMware/Spring/TENABLE, IBM, Red Hat, OSV) confirm remote code execution risk and provide fixes: upgrade ...

CVE-2022-22980

creationtimestamp| type| source ---|---|--- 2022-06-21 11:43:30+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/2547 2022-06-21 13:27:29+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/2549 2022-06-21 14:10:11+00:00| published-proof-of-concept|...

Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb

CVE-2022-22980 A local based poc of CVE-2022-22980, for the d...

Spring Data MongoDB SpEL Expression Injection Vulnerability (CVE-2022-22980)

Updates 06-20 CVE-2022-22980 is published 06-20 Spring Data MongoDB 3.4.1 and 3.3.5 are available Table of Contents Overview Vulnerability Am I Impacted Status Suggested Workarounds Overview We would like to announce that we have released Spring Data MongoDB 3.4.1 and 3.3.5 to address the followi...

CVE-2021-22980

creationtimestamp| type| source ---|---|--- 2021-02-12 20:43:52+00:00| seen| https://t.me/cibsecurity/23555...

CVE-2021-22980

In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility CTU for Windows could allow an attacker to load a malicious DLL library from its current directory. User...

CVE-2021-22980

CVE-2021-22980 is an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows. Affected CTU versions: Edge Client 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5. The issue allows loading a malicious DLL from the utility...